To enable SSPR to read custom http headers for authentication, you need to set SSO Authentication Header Name under Settings > Security.
This allows authentication to SSPR without the user's password. However, before being able to interact with the directory such as setting a new password, the users are prompted for their existing passwords.